Changeset 96354 in webkit

Timestamp:

Sep 29, 2011 1:45:52 PM (13 years ago)

Author:

fpizlo@apple.com

Message:

Structure transitions involving many (> 64) properties sometimes cause structure corruption
​https://bugs.webkit.org/show_bug.cgi?id=69102

Reviewed by Darin Adler.

Made m_offset an int instead of a signed char. Changed the code to ensure that transitions
don't lead to the dictionary kind being forgotten.

• runtime/Structure.cpp:

(JSC::Structure::Structure):

• runtime/Structure.h:

Location:

trunk/Source/JavaScriptCore

Files:

• ChangeLog (modified) (1 diff)
• runtime/Structure.cpp (modified) (1 diff)
• runtime/Structure.h (modified) (2 diffs)

trunk/Source/JavaScriptCore/ChangeLog

@@ +1 @@
+2011-09-29  Filip Pizlo  <fpizlo@apple.com>
+
+        Structure transitions involving many (> 64) properties sometimes cause structure corruption
+        https://bugs.webkit.org/show_bug.cgi?id=69102
+
+        Reviewed by Darin Adler.
+        
+        Made m_offset an int instead of a signed char. Changed the code to ensure that transitions
+        don't lead to the dictionary kind being forgotten.
+        
+        * runtime/Structure.cpp:
+        (JSC::Structure::Structure):
+        * runtime/Structure.h:
+
 2011-09-29  Yuqiang Xian  <yuqiang.xian@intel.com>
 

trunk/Source/JavaScriptCore/runtime/Structure.cpp

@@ -203 +203 @@
     , m_propertyStorageCapacity(previous->m_propertyStorageCapacity)
     , m_offset(noOffset)
-    , m_dictionaryKind(NoneDictionaryKind)
+    , m_dictionaryKind(previous->m_dictionaryKind)
     , m_isPinnedPropertyTable(false)
     , m_hasGetterSetterProperties(previous->m_hasGetterSetterProperties)

trunk/Source/JavaScriptCore/runtime/Structure.h

@@ -238 +238 @@
         bool isValid(ExecState*, StructureChain* cachedPrototypeChain) const;
 
-        static const signed char s_maxTransitionLength = 64;
-
-        static const signed char noOffset = -1;
+        static const int s_maxTransitionLength = 64;
+
+        static const int noOffset = -1;
 
         static const unsigned maxSpecificFunctionThrashCount = 3;
@@ -265 +265 @@
 
         // m_offset does not account for anonymous slots
-        signed char m_offset;
+        int m_offset;
 
         unsigned m_dictionaryKind : 2;